Conversation
Every branch built against this base was failing to build/boot in CI with ExceptionInInitializerError: TypeTag :: UNKNOWN, because lombok 1.18.36 can't reflectively patch JDK 25's javac internals. Baking the fix into the fork's own dc34-ctf base so every future branch inherits it automatically instead of needing a manual per-branch cherry-pick. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
IDORViewOwnProfileAltUrl.completed() (POST /IDOR/profile/alt-path) split
the user-supplied 'url' parameter with the default split("/") and only
ever inspected indices [0..3], never checking the resulting array's
length. Java's default split() also silently drops trailing empty
strings, so a value with extra path segments (or a trailing slash)
appended after the legitimate own-profile id segment still matched
urlParts[0..3] and was accepted as if it were exactly
'WebGoat/IDOR/profile/{authUserId}'.
Fix: split with a limit of -1 so trailing empty segments are preserved
instead of silently dropped, and require the resulting array to be
exactly 4 elements long before checking the four expected path
segments. Only a value that is EXACTLY 'WebGoat/IDOR/profile/{authUserId}'
(no more, no fewer segments) is now accepted.
Locally verified in WSL: built + booted the app, registered a user,
authenticated as tom via POST /IDOR/login, confirmed the legitimate
flow (url=WebGoat/IDOR/profile/2342384) still succeeds, and confirmed
both a trailing-slash variant and an extra-segment variant of the
alt-path value are now rejected where they previously succeeded.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🏆 WebGoat — CTF Patch Score0 / 69 challenges patched
Commit: No points yet — this commit didn't solve any challenges, so there's nothing on the leaderboard for it. Patch a vulnerability and push again! 💪 |
Author
|
Closing as part of a full stand-down of this CTF push. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
IDORViewOwnProfileAltUrl.completed()(POST /IDOR/profile/alt-path) split the user-suppliedurlparameter with the defaultsplit("/")and only ever inspected indices[0..3], never checking the resulting array's length. Java's defaultsplit()also silently drops trailing empty strings, so a value with extra path segments (or a trailing slash) appended after the legitimate own-profile id segment still matchedurlParts[0..3]and was accepted as if it were exactlyWebGoat/IDOR/profile/{authUserId}.Fix
Split with a limit of
-1so trailing empty segments are preserved instead of silently dropped, and require the resulting array to be exactly 4 elements long before checking the four expected path segments. Only a value that is EXACTLYWebGoat/IDOR/profile/{authUserId}(no more, no fewer segments) is now accepted.Verification (local, WSL)
tomviaPOST /IDOR/login.url=WebGoat/IDOR/profile/2342384) still succeeds with the correct profile output.url=WebGoat/IDOR/profile/2342384/) now fails (previously succeeded).url=WebGoat/IDOR/profile/2342384/extra) now fails (previously succeeded).🤖 Generated with Claude Code